Because the tree comes from the browser's accessibility data, `cd navigation/` and `click submit_btn` mean the same thing across sites — no per-site selectors, no screenshot parsing. The safety model is unusually explicit: writes and navigation are off out of the box, `--domains` pins commands to hosts you name, and every command lands in an audit log. Per-action confirmation prompts exist behind `--confirm` but are off by default, because the server's terminal is usually not where the agent is running.
A Chrome extension that maps the browser into a virtual filesystem: windows and tabs are top-level directories, and each tab's accessibility tree becomes nested folders where containers are directories and buttons, links and inputs are files. A hardened MCP server exposes that shell to any MCP client.
- `domshell_execute` — one tool that takes a command string exactly as you would type it in the shell, and accepts several newline-separated commands in a single call
- Navigation and reading: `ls`, `cd`, `pwd`, `tree`, `cat`, `text` for bulk extraction, `grep`, `find` by role, plus `tabs` and `windows`
- Acting on the page: `click`, `focus`, `type`, `scroll`, `select`, and `navigate` / `open` for going somewhere new
- Command chaining and a pipe operator, so a find can be filtered and fed onward in one round trip
- Read-only by default — navigation and write commands stay off until you pass `--allow-write`, and cookie access needs `--allow-sensitive`
- A domain allowlist and an audit log recording every command with a timestamp
The DOMShell Chrome extension, plus the MCP server run separately with npx. The server listens on two ports: HTTP for MCP clients and a WebSocket bridge for the extension. Both sides must present the same token — set it with `--token`, or let the server generate one and paste it into the extension's options page. A setup wizard detects installed clients and writes their configs for you.
One command — npm install -g @apireno/domshell